mixin

To improve the security, it's good to start eliminating dependencies. Domains are a good start point.

add a category in the sessions table, the normal sessions should expire after 6 hours, but the api session won't expire, and the expiration time is the only difference between them.

add a button to generate a new API session, and whenever a new API session created, expire all old API sessions.